Safeguard Your E-Commerce Website

Software Currency

Software products have 3 phases; active, supported, and end-of-life. Active means there are patches to the functionality. Supported means security patches get retrofitted. End-of-life means there is no support from the vendor. The payment card industry mandates software receive current security patches. The chart shows that most websites, charted to the left in red, do not receive security patches. Typically, the patching command runs successfully on out-of-support software, but the vendor stopped updating the repository. The diagram is for PHP, the most popular language for building websites. An in-support operating system or any other component can run on can run an out-of-support programming language. So the website administrator must check if each software package is still under support. Small vendors, like those creating website plugins and themes, may not follow the security practices defined by CIS (Center for Internet Security). Those e-commerce vendors fall under the PCI-DSS (Payment Card Industry - Data Security Standard). However, in the SMB space, only some vendors follow the standard.

Technology Lifespan

The shelf life of software varies dramatically. WordPress, the CMS (Content Management System) with the largest market share of websites, only supports the current version. That requires immediate updates without prior testing, which is an operational hazard. PHP has a shelf life of 2 years. Avoiding the issues of being first on and last off a release results in updating it at least once a year. At the same time, most operating systems remain in support for ten years. The lifespan of the selected software defines an upgrade schedule for the website.

Robust Security Measures

Our risk mitigation strategy includes implementing robust security measures to protect your website from attacks. We employ honey pot traps to detect and filter out bots, enhance payment security through verification measures, combat shipping fraud with address cross-checks and monitoring, fortify against page hijacking with content security policies and secure DNS practices, and ensure forward security to protect user sessions. Our intrusion prevention systems also detect and block suspicious activity, safeguarding your website from potential threats.

Payment Risks

The proper design of e-commerce solutions can significantly lower payment risk, retain the credit rating for the business, and lower operational costs. Suggested features include:

• Reject payments that provide incorrect CVV, the card's three-digit security code.
• Check the street address and postal code with the client's bank.
• Send the invoice immediately but delay charges until the client receives the goods.
• Confirm the phone number by getting a response to a text message.
• Cancel orders if an email sent to the user bounces.
• Authenticate users through a 3rd party service like Gmail and Facebook.
• Block repeated purchases from the same IP address.

Shipping Fraud

Shipping fraud is when the package never arrives, or the recipient claims non-delivery. Protections include:

• Cross-check that the shipping address matches the billing address from the client's credit card.
• Check if the geolocation of the web browser matches the shipping address.
• Avoid shipments to PO boxes because they mask the valid owner.
• Get a 3rd party service to flag suspicious delivery addresses known for fraudulent activity.
• Monitor activity around an address change to an existing user account, looking for other signs of a user account takeover.
• Check if phone numbers have an area code matching the delivery address.
• Limit deliveries to countries that prosecute fraud because there is considerable fraud from those countries.

Intrusion Prevention

IPS (Intrusion Prevention Systems) detects suspicious activity and blocks the source IP from accessing the website, as shown in the diagram. A block happens after a trigger event that legitimate users would never try. Blocked users experience hanging for all subsequent connection attempts.

Page Hijacking

E-Commerce page hijacking is when the page's content gets compromised by a 3rd party. These attacks typically harvest credit card data for months before launching an attack. So even the system backups are corrupt. Best practices to avoid hijacking include:

• Verify all the domains providing content to the page follow PCI-DSS (Payment Card Industry - Data Security Standard). That applies to 3rd party sources for fonts, analytic tools, and the JavaScript libraries downloaded by the plugins and applications within the page.
• Apply a Content Security Policy (CSP) to all content on the page. It's an HTTP header defined by the web server that restricts which domains can provide what types of content to the web page.
• Enable HSTS and DNS SEC. Those security standards prevent 3rd party DNS services, such as those in hotels and hotspots, from spoofing the response and sending requests to compromised websites.

Honey Pot Traps

Input forms, like "Contact Us," are frequent attack vectors. Honey pot traps use deception to trick bots into doing something that humans would not so the website can filter them out. The simplest is to make an input field invisible to the user because bots rarely analyze pages that deeply. If the bot takes the bait, the server deletes the message.

Forward Security

Forward security means each user session has a unique and randomly generated key. If someone gets access to your long-term private key, it will not help them decrypt prior or recorded network traffic. In addition, they need to capture the network traffic used to negotiate a user's session key while connecting to decrypt the message.

Disaster Recovery

Disaster recovery plans must swiftly restore your systems when confronted with unexpected events. Proactively testing failure scenarios and validating restoration ensures the strategies are effective. A comprehensive set of procedures enables the website to return online even in the most challenging circumstances.